Password Protect all .cfm files in a directory?

Report · Jun 12, 2014

Greetings

Can anyone share the code one one put within the application.cfm to password-protect all the files in that directory?

The UN & PW are stored in a DB - of course I could create a session_ID and protect each page individually, which I have been doing for years, but in this case, the pages are being loaded using a half-*ss CMS and the users, other than saving files as .cfm, will not be responsible to leave the code on each page.

In the DB, the user name is subscriber_email, the password is subscriber_password.

Thanks for any help.

Report · Jun 16, 2014

It is unclear what you wish to password-protect against. Accessing the directory? Writing a file into it? Opening a file in it? Requesting a CFM file in it by means of the browser?

Report · Jun 16, 2014

Thank you for your reply.

The administrator will be uploading files to the directory via FTP. His access is controlled at that point.

Users need to sign up via a form and pay a fee. Once they are approved, they should be able to access all the CFM files in that directory via their browser.

Again, I have accomplished this for years by simply creating a session ID, and, at successful login protected every page individually:

webpage

</cfelse>

but never had admins in control of uploading web pages that are unfortunately poorly coded and could never be responsible to add the above code to each page.

What is your advice?

Thanks again

Norman

Report · Jun 16, 2014

You have to add the above code to just one page, namely, Application.cfm. In other words, your approach remains valid.

Report · Jun 16, 2014

SO then this would be within application.cfm:

SELECT subscriber_ID, subscriber_fname, subscriber_email, subscriber_password

FROM main

WHERE subscriber_email = '#Trim(form.subscriber_email)#'

AND subscriber_password = '#Trim(form.subscriber_password)#'

</CFQUERY>

</cflock>

</cfif>

and this would protect all cfm pages in the directory?

It seems as if it would not be necessary to create a session.user_id?

Report · Jun 16, 2014

Yes, you could do it without sessions. For example, use the cflogin framework in Application.cfm. You should set, beforehand, loginStorage="session" in the cfapplication tag.

SELECT subscriber_ID, subscriber_fname, subscriber_email, subscriber_password

FROM main

WHERE subscriber_email = <cfqueryparam value='#Trim(form.subscriber_email)#' CFSQLTYPE='CF_SQL_VARCHAR'>

AND subscriber_password = <cfqueryparam value='#Trim(form.subscriber_password)#' CFSQLTYPE='CF_SQL_VARCHAR'>

</CFQUERY>

</cfif>

</cflogin>

Instead of a session variable, the test variable then becomes getAuthUser(). If the user is unauthenticated, getAuthUser() will be an empty string. Also, Coldfusion will only run the cflogin tag if the user is unauthenticated. The cfloginuser tag logs the user in. Once that happens, getAuthUser() assumes the value #auth_admin.subscriber_email#.

Some caveats. You will see that I am using cfinclude instead of cflocation. Using cflocation in Application.cfm can be problematic. Since the Application file is included at the beginning of every request, using cflocation in it might result in a request repeating indefinitely.

Report · Jun 17, 2014

Hello

What is happening now is regardless if the username and password are correct, it sends to user back the the login page (there is no application.cfm file in the top directory, nor would this matter because the login form is an html file).)

This is how I set up the application.cfm:

<cfapplication name="xxxx"

clientmanagement="Yes"

loginStorage="session"

sessionmanagement="Yes"

sessiontimeout="#CreateTimeSpan(0,0,20,0)#"

SetClientCookies="Yes">

SELECT subscriber_ID, subscriber_fname, subscriber_email, subscriber_password

FROM main

WHERE subscriber_email = <cfqueryparam value='#Trim(form.subscriber_email)#' CFSQLTYPE='CF_SQL_VARCHAR'>

AND subscriber_password = <cfqueryparam value='#Trim(form.subscriber_password)#' CFSQLTYPE='CF_SQL_VARCHAR'>

</CFQUERY>

</cfif>

</cflogin>

SetEncoding("form","utf-8");

SetEncoding("url","utf-8");

</cfscript>

Report · Jun 18, 2014

You might later need to add CFML code to the login page to extend its functionality. So, to start with, you should rename the login page to login.cfm. Otherwise, it is not a ColdFusion page. You may rename it from HTML to CFM without changing its content.

On to the main business. If you continue to see the login page, then Coldfusion must be running the cflogin tag. It implies that the user is not yet logged in, which in turn implies that the cfloginuser tag has yet to run. This suggests the query's recordcount is 0.

To test this hypothesis, temporarily delete the query's where-clause. What happens then?

There is another point. The cflogin framework is strictly for authentication. I would therefore put the following code elsewhere:

<cfinclude template="index.cfm">

In fact, so long as the user is logged in, Coldfusion wont run the tag cflogin. The page index.cfm will therefore not be included. That is actually the opposite of what you want.

One solution is to place the following code at a suitable location after the cflogin end-tag:

</cfif>

Report · Jun 19, 2014

BKBK: Hello again

I was under the impression that this method of protecting everything in the directory from being accessed unless the username and password were correct would also apply to the login.cfm page itself if the file resided in the same directory. That's why I kept it as an HTML file.

So I put the login form page back in the directory as login.cfm with application.cfm and this is the code:

<cfapplication name="xxxx"

clientmanagement="Yes"

loginStorage="session"

sessionmanagement="Yes"

sessiontimeout="#CreateTimeSpan(0,0,20,0)#"

SetClientCookies="Yes">

SELECT subscriber_ID, subscriber_fname, subscriber_email, subscriber_password

FROM main

WHERE subscriber_email = <cfqueryparam value='#Trim(form.subscriber_email)#' CFSQLTYPE='CF_SQL_VARCHAR'>

AND subscriber_password = <cfqueryparam value='#Trim(form.subscriber_password)#' CFSQLTYPE='CF_SQL_VARCHAR'>

</CFQUERY>

</cfif>

</cflogin>

This does not work- it simply sends me back to the login page regardless.

BTW the form is set: <form action="index.cfm" method="POST">

Thanks for your continued help with this.

Report · Jun 19, 2014

You apparently misunderstood my suggestion to place the last cfinclude code outside the cflogin tag. In any case, it doesn't matter now, given the current information. Since index.cfm is the action page of the login form, it should not be cf-included. If login is successful, the form will post to index.cfm anyway, which is effectively a new request.

SELECT subscriber_ID, subscriber_fname, subscriber_email, subscriber_password

FROM main

WHERE subscriber_email = <cfqueryparam value='#Trim(form.subscriber_email)#' CFSQLTYPE='CF_SQL_VARCHAR'>

AND subscriber_password = <cfqueryparam value='#Trim(form.subscriber_password)#' CFSQLTYPE='CF_SQL_VARCHAR'>

</CFQUERY>

</cfif>

</cflogin>

Now, ensure that there is a text field named subscriber_email in the form. Verify spelling! Also verify that the values of the (subscriber_email, subscriber_password) pair that you use in testing actually exist in the database table.

Report · Jun 25, 2014

Oh, and there is also the logout page, to log the logged-in user out. You could include a condition in the application file to place a logout link on every page. For example,

Adobe Community

Password Protect all .cfm files in a directory?